Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ngclient: test fast-forward recovery #1713

Closed
jku opened this issue Dec 8, 2021 · 3 comments
Closed

ngclient: test fast-forward recovery #1713

jku opened this issue Dec 8, 2021 · 3 comments
Assignees
Milestone

Comments

@jku
Copy link
Member

jku commented Dec 8, 2021

I think we do not currently test successful rollback (aka fast-forward recovery) for timestamp, snapshot and targets:

  • simulate a fast-forward attack: create repository with valid timestamp/snapshot/targets with version=MAX_VERSION (or something large anyway)
  • update client so it sees the large versions
  • rotate the affected key (timestamp or snapshot) and set metadata version=1
  • update client, assert that new metadata is accepted by ngclient (even though the version number is lower than the local version)
@jku jku added this to the Sprint 14 milestone Dec 8, 2021
@kairoaraujo
Copy link
Collaborator

Please, can you sign this issue for me?

@jku
Copy link
Member Author

jku commented Dec 15, 2021

create repository with valid timestamp/snapshot/targets with version=MAX_VERSION

I'm not sure if there even is a practical MAX_VERSION in our implementation -- python seems to seamlessly upgrade from an int to some big int implementation... I think this is not relevant anyway: the point is that version is something large that we want to reinitialize to 1.

@jku
Copy link
Member Author

jku commented Jan 11, 2022

I think we're done here! Thanks Kairo

@jku jku closed this as completed Jan 11, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants